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Spacecraft multi-body separation events during atmospheric descent require complex 
testing and analysis to validate the flight separation dynamics models used to verify no 
re-contact. The NASA Orion Multi-Purpose Crew Vehicle (MPCV) architecture includes a 
highly-integrated Forward Bay Cover (FBC) jettison assembly design that combines 
parachutes and piston thrusters to separate the FBC from the Crew Module (CM) and avoid 
re-contact. A multi-disciplinary team across numerous organizations examined key model 
parameters and risk areas to develop a robust but affordable test campaign in order to 
validate and verify the FBC separation event for Exploration Flight Test-1 (EFT-1). The FBC 
jettison simulation model is highly complex, consisting of dozens of parameters varied 
simultaneously, with numerous multi-parameter interactions (coupling and feedback) among 
the various model elements, and encompassing distinct near-field, mid-field, and far-field 
regimes. The test campaign was composed of component-level testing (for example gas-piston 
thrusters and parachute mortars), ground FBC jettison tests, and FBC jettison air-drop tests 
that were accomplished by a highly multi-disciplinary team. Three ground jettison tests 
isolated the testing of mechanisms and structures to anchor the simulation models excluding 
aerodynamic effects. Subsequently, two air-drop tests added aerodynamic and parachute 
elements, and served as integrated system demonstrations, which had been preliminarily 
explored during the Orion Pad Abort-1 (PA-1) flight test in May 2010. Both ground and drop 
tests provided extensive data to validate analytical models and to verify the FBC jettison event 
for EFT-1. Additional testing will be required to support human certification of this 
separation event, for which NASA and Lockheed Martin are applying knowledge from Apollo 
and EFT-1 testing and modeling to develop a robust human-rated FBC separation event. 
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CMUS 

= 

Crew Module Uprighting System 

CPAS 
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Capsule Parachute Assembly System 
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= 
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I. Orion Descent & Landing Con-Ops 

O rion is the next- generation NASA human spacecraft, intended to take humans to deep space destinations such as 
asteroids, Lagrangian points, the moon and eventually Mars. Orion, as shown in Fig. 1, is comprised of a Launch 
Abort System (LAS), Crew Module (CM) and Service Module (SM). Orion jettisons the LAS during ascent prior to 

on-orbit insertion, and jettisons 
the SM approximately 20 
minutes prior to re-entry, 
leaving the CM to handle entry, 
descent and landing (EDL). 
Orion has successfully 
completed two major flight 
tests, Pad Abort- 1 (PA-1) in 
2010 and Exploration Flight 
Test-1 (EFT-1) in 2014. PA-1 
was primarily a demonstrator 
of the Launch Abort System. 
EFT-1 served as a pathfinder 
for manufacturing and 
assembly, and provided critical 
data about on-board systems 
including EDL hardware. 

The Orion EDL 
architecture was established 
through a series of design iterations and challenges, taking into consideration historical Apollo Program expertise and 
early development testing. The Orion EDL descent sequence is depicted in Fig. 2, nominally starting at the end of 
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Figure 1. Schematic diagram of Orion. 
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atmospheric entry at a navigated altitude of 24000 ft MSL. 
At this altitude, the Forward Bay Cover (FBC) is jettisoned from the CM 1 . 
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Figure 2. Mission sequence diagram for Orion. 

The FBC encloses and protects the CM Forward Bay, where a large percentage of EDL hardware resides, such as 
parachutes and mortars as well as uprighting bags. The FBC is mechanically attached and retained to the CM by three 
FBC pyrotechnic gas-piston thrusters, with preload reacted through 18 aft attachment mechanisms. When the 
Guidance, Navigation & Control (GN&C) system determines the proper conditions for nominal FBC jettison based 
on an altitude less than 24000 ft MSL, a signal is sent to fire the three FBC parachute mortars installed on the forward 
deck of the FBC. In the contingency case of CM instability, FBC jettison is triggered early if yaw/pitch body rate is 
greater than 20 degrees per second, and altitude less than35000 ft MSL. 

The FBC passes through three regimes that could result in re-contact with the CM: 

• Near-field separation - Within multi-body separation distances of one FBC radius to the nearest CM structure 
or hardware 

• Mid- field separation - FBC beyond near-field but within approximately 100 ft of the CM (reflecting the 
requirement to prevent interference with drogue parachutes mortared from the CM shortly after FBC jettison) 

• Far-field separation - Anything beyond mid-field separation that could bring the FBC within striking distance 
of a main parachute or the CM 

The inflated FBC parachutes (FBCPs) apply loads to the CM/FBC until FBC release. A delay of 1 .4 seconds from 
mortar fire to FBC release and thruster actuation is designed to allow the parachutes to fully inflate prior to FBC 
jettison. Then the three piston thrusters, each driven by dual gas generators, are used to release and then push the FBC 
away from the CM. These thrusters guide the FBC for roughly the first 15 inches to clear the CM tunnel and prevent 
near-field re-contact with the CM. The FBC is then pulled away from the CM by the deployed parachutes, preventing 
mid-field re-contact. Once in the far-field, the FBC will descend under its parachutes until reaching the water. 

Following FBC jettison, the CM drogue parachutes are deployed. At a navigated altitude around 8000 ft MSL, the 
CM main parachutes are deployed. The mains go through a series of reefing stages to limit loads on the CM and avoid 
imparting severe loads on the crew members. The final touchdown orientation control includes Reaction Control 
System (RCS) thruster control starting around 1500 ft MSL. Orion is a water-landing capsule with planned splash- 
down locations off the coast of California in the Pacific Ocean. Upon splash-down, the riser cutters jettison the main 
paracutes and the Crew Module Uprighting System (CMUS) deploys. The purpose of CMUS is to upright the CM in 
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the event the capsule does not land upright or is inverted upon splash-down. CMUS has five airbags that deploy from 
the Forward Bay, which applies a moment to the CM that causes rotation to the upright position. 

II. FBC Separation Event Design History 

The Orion architecture is based on Apollo, so understanding its history and lessons learned is important. Apollo 
program went through several Forward Heat Shield (FHS) architectures, similar to Orion FBC, before finally settling 
on a workable system. The main challenge was to provide enough energy to the FHS to ensure successful transit 
through the CM wake without reversing direction or re-contacting the CM. During air drop tests and flight tests, 
engineers were repeatedly surprised by the effects of the CM wake on FHS clearance to the CM. During Block I, 
Apollo FHS had four piston thrusters and no parachute. After ten drop/boilrerplate tests, in February 1966 during 
another Apollo system test for Block I (AS201), an on-board camera captured the FHS returning toward the upper 
deck of the spacecraft following the jettison event. It was clear that four piston thrusters alone did not provide sufficient 
energy to thrust the FHS through the CM wake reverse flow, so a parachute was added to the three remaining Block I 
tests. For Block II, the thruster system was re-designed and the FHS parachute was removed. However, during the 
third and final boilerplate Block II qualification drop test (73-5), in January 1967, the forward bay camera captured 
the FHS loitering in the wake. For the final Block II Heavy design, the designers re-incorporated a single mortar 
deployed parachute following jettison, which was successfully assessed duing four additional drop tests 2 . 

Far- field re-contact was also a major concern on 
Apollo. During Apollo 15, one of the three main 
parachutes failed around the time that the FHS 
passed the CM during final decent, depicted in Fig. 

3. Although the evidence pointed toward hydrazine 
erosion of the riser due to propellant off-loading, 
the FHS passed very close to the CM, highlighting 
the FHS far-field re-contact risk to a main 
parachute. Based on a low probability of contact, 
and impact test results indicating FHS contact with 
the main parachute cluster would not 

be catastrophic, the Block II design remained 
unchanged following the Apollo 15 anomaly. From 
Apollo, Orion learned the importance of assessing 
mid-field and far-field re-contact. Applying lessons learned from Apollo, especially that the reverse CM wake flow is 
strong, drove the current system design in which FBCPs deploy and inflate prior to FBC thruster initiation 3 " 4 ’ 11 . 



Figure 3. Apollo 15 main chute failure. 
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Similar to Apollo, the Orion FBC system design has evolved 
considerably throughout the program. At the start of the program in 
late 2006, Orion had a single-piece FBC with gas-piston thrusters 
(like Apollo) except that two FBC parachutes were included for full 
redundancy. This design is depicted in Fig. 4, and was maintained 
as the baseline successfully flown on Orion PA-1 in May 2010. 

But a year into the program, in the Fall of 2007, GN&C 
simulations showed significant probability of CM flipover between 
drogue parachute release and main parachute deployment. CM apex 
forward cases were caused by high uncertainties on CM dynamic 
stability derived from an early aerodynamic database 5 . A flipover 
at this stage is tantamount to loss of mission, as the apex of the CM 
is essentially pointed toward the ground, and this significantly 
increases the risk for failure of the main parachute deployment. A 
CM apex forward could cause an exceedance in the main parachute 
design limit loads, causing one or more parachutes to break away 
from the CM or sustain substantial damage. 

The risk of a CM apex forward scenario drove the Orion team 
to recommend a change in architecture in January 2008 such that 
the drogue parachutes pulled away the FBC, the FBC pulled out and 
Figure 4. Early Orion baseline (Fall deployed the main parachutes, and the FBC descended under an 

2006) later flown on PA-1 (May 2010). auxiliary chute in the far- field 6 " 7 . This design is depicted in Fig. 5. 

In this way, the CM would avoid free-falling after drogue deploy, 
and therefore the risk of an apex forward during main deployment would be eliminated. Unfortunately, this 
architecture imparted severe loads onto the FBC, even before factors of safety and dynamic amplification factors were 



Drogues separate 
FBC from CM 


Drogues deploy thru FBC 



CM descending under mains 


Figure 5. Baseline change approved January 2008. 


applied, and created a nearly impossible clearance problem between the FBC-mounted drogue mortars and the CM 
docking tunnel. 
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Orion formed an Integrated Design Assessment Team (ID AT) in June 2009 to solve this and other problems with the 
descent and landing phase of the mission. This was an Orion mutli-disciplinary team from all vehicle subsystems, 
including experts from NASA Jet Propulsion Laboratory (JPL), parachute industry and Apollo. IDAT solved the 
architecture problems by retaining the basic FBC shape but segmenting the FBC into six pieces and using airbags to 
jettison the pieces clear of the CM wake, depicted in Fig. 6 8 . Each segment was jettisoned by a single airbag. This 
design concept was considered achievable with bounding, worst case aerodynamic assumptions. However, by early 
2010, the design was not closing. The velocity required to clear the segments from the wake resulted in airbag forces 
that would overstress the FBC segments and the main parachutes underneath. The nominal deployment for the 
segmented system was 41000 ft. MSL, and this presented an additional challenge because flight testing is much more 
expensive at higher altitudes and higher Mach numbers. The team studying the problem determined that a higher- 
fidelity mid-field simulation would need to be developed to produce FBC segment trajectory predictions with higher 
confidence. High uncertainties in the modeling led to an increased jettison velocity that the airbag system would need 
to deliver. The required increased jettison force applied to the FBC panels meant that the FBC panels would need to 
increase thickness, thus adding more mass to the FBC. The issue became highly cyclical and the right system balance 
between necessary jettison force and the added mass to withstand the force did not converge. 

The FBC Jettison Tiger Team was formed in June 2010 to balance margins across subsystems and close the 
baseline six-segment design. After several months of study, the IDAT six-segment airbag-deployed system was 
replaced for several reasons. The main problem was modeling the aerodynamics of the FBC segments in the wake. 
Attempts to refine the model to derive a lower jettison velocity revealed that quantifying the CM wake characteristics 
was an exceedingly difficult and computationally expensive task. Computational dynamics models could not predict 
the paths of segments through the CM wake with a high enough degree of confidence, so the aerosciences community 
could not support the probabilistic assessment given the fidelity of the CM wake models, despite utilizing sophisticated 

unsteady CFD methods including Detached Eddy Simulation 
(DES) and Large Eddy Simulation (LES) approaches. It was 
estimated to take several million dollars in wind tunnel testing 
to validate the models and there was still no guarantee that the 
design would close. The next problem was the imparted loads 
on the main parachutes and drogue mortars under the airbags. 
The team had no experience with such a system and their 
concern was that the resulting reaction load from the airbag on 
the main parachutes and drogue mortars could damage the soft 
goods or the reefing line cutters. There was also the difficulty 
of reliably controlling the tolerance of the parachute outer 
surface to serve as a push-off plate. In August 2010, at the 
Parachute Systems Critical Design Review (CDR), four veteran 
engineers from the Apollo program weighed in, recommending 
that the segmented FBC with airbag deployment presented too 
much risk to the main and drogue parachutes. 

Testability was also a major problem. The segmented 
system had a 41000 ft MSL baseline deployment altitude. Drop testing at that altitude is costly because a B-52 is 
required and also theaircraft was unavailable to Orion. At lower altitudes, the six-segment system required even more 
jettison velocity. 

Ultimately, the high uncertainty in aerodynamics-based Loss of Crew (LOC) calculations, testability concerns, 
and challenges in mechanizing an airbag system to eliminate the re-contact risk drove the project to decide to change 
the architecture again in September 2010. By that time, refinements in the CM aerodynamic stability coefficients via 
LaRC Vertical Spin Tunnel testsenabled a system where parachutes could be applied to the FBC for a short period of 
time (seconds) without causing CM flipover 3 ’ 9 " 10 . In December 2010, the baseline was changed to a single-piece FBC 
with redundant parachutes to clear the mid- field wake, similar to Apollo and Orion PA-1. This change was coupled 
with a reduction in deployment nominal altitude from 41000 ft MSL to 24000 ft MSL, which was within reach of 
existing C-17 test aircraft, and therefore an enormous cost benefit. 

As Orion traded six-segmented FBC deployed by airbags to a monolithic FBC deployed by thrusters, several 
design studies took place. Considerations for the different trades included mass, hardware redundancy, and reliability. 
Fig. 7 shows the final EFT-1 layout just prior to flight. 



Figure 6. IDAT re-design, six-segment 
airbag-deployed system, August 2009. 
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Figure 7. EFT-1 Forward Bay and Forward Bay Cover prior to flight. 

For the parachutes, the Orion program examined having two or three FBCPs mounted in the CM Forward Bay or 
attached to the FBC. The Orion program decided to attach the FBCPs to the FBC due to a relatively simple 
mortar/chute attachment to the FBC and because the expended mortars would leave with the FBC, creating fewer 
hazards for the main parachutes and the Crew Module Uprighting System (CMUS) airbags. The FBCPs were arranged 
on the FBC to help distribute attachment point load torques and FBCP mortar reaction loads across the FBC. Three 
parachutes were chosen to provide fault tolerance (minimum separation loads and tolerable net torques) in the case of 
a single FBCP failure. Lastly, each FBCP mortar included two NASA Standard Initiators (NSIs) with a single gas 
generator to address the possibility of a loss of a single firing circuit. The three piston thrusters were implemented to 
preclude near- field re-contact, with a goal of maximizing the length of stroke. In order to maximize the length of 
stroke, the thrusters were mounted inside the Forward Bay, which provided approximately 15 inches of stroke. The 
overall integrated system was designed for minimum risk by each thruster having two gas generators, each initiated 
by a single NSI. With this configuration, the thruster and integrated system can still perform successfully given a 
single gas generator failure. In late 2011, LM created the FBC Separation Event Lead position to integrate and balance 
the system-level efforts involving this jettison event, which paired with the existing NASA Integrated Landing 
Systems Manager. These positions contributed significantly to ensuring that critical activities have been identified, 
prioritized and executed. 


III. EFT-1 FBC Separation Modeling and Testing 

The FBC jettison event requires multi-disciplinary subsystem and environment teams to integrate modeling, 
analysis, hardware design and testing. This requires integration across GN&C, mechanisms, pyrotechnics, avionics, 
flight software, parachutes, stress, thermal protection, loads, dynamics, thermal, reliability, structures and 
aerodynamics disciplines. All of these teams participate in the modeling of the FBC separation event by providing 
their respective discipline models in three distinct phases (near- field, mid- field and far- field) shown in Fig. 8: 



Figure 8. FBC separation event sequence. 
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Orion uses a different model for each phase of the separation event, where GN&C provides the vehicle dynamics 
for the inputs and then hands-off the inputs to the near-field, mid- field and far- field separation simulations. For each 
phase, the FBC is required to maintain a positive separation without returning towards the CM and re-contacting the 
CM, so each phase examines the FBC distances from the CM, drogue and/or main parachutes. The simulation tools 
assess critical clearances for the near-field and minimum separation distances for the mid-field and far- field. 

Each distinct phase has key parameters. The near- field is primarily driven by the forces and moments of the 
thrusters, parachutes, proximity aerodynamics, suction (which depends on descent venting) and initial trajectory 
conditions 12 . The mid-field is primarily driven by the FBC jettison velocity, CM wake and parachutes. The goal of the 
mid-field analysis is to determine whether the FBC stays clear of the drogue parachutes which deploy shortly after 
FBC jettison. For EFT-1, pre-flight simulation of mid-field separation performance verified the design for several 
cases of nominal deployment and failure scenarios (e.g., FBCP and PDU and RCS), and assessed the design against 
cases of thruster gas generator failure and 2-3 FBCP failures for system-level probabilistic reliability assessment. 

Once the FBC has cleared the mid-field CM wake under its FBCPs, the remainder of its descent to splashdown 
occurs in the far-field. Since the FBC jettison altitude was lowered to 24000 ft MSL, there is far- field re-contact risk 
because the CM trajectory is relatively steep at FBC jettison and the jettisoned FBC initially follows the CM down a 
nearly adjacent flight path. The FBC will often pass the CM once the drogues and high-drag mains are deployed to 
decelerate the CM. Modeling and assessment of this risk have indicated that wind speed and especially wind direction 
are major risk drivers. 

For EFT-1, the Orion program went through a rigorous process of defining tests required among all the critical 
separation events. For the FBC separation event, all key modeling parameters were identified and rated as low, 
medium or high risk based on the confidence level the program had in accurately determining the modeling parameter. 
A low risk rating was given if there was sufficient testing to anchor the parameter, or if the parameter was determined 
to have a second-order effect that did not significantly impact the overall separation event. A medium risk rating was 
given if some testing was planned to anchor the model parameter with some level of confidence. High risk ranking 
was given if there was low confidence that testing adequately anchored the modeling parameter. Through this process, 
three key modeling parameters stood out with high risk ratings: interactive parachute loads, system timing and FBC 
aeroload changes. 

Interactive parachute loads was deemed a high risk rating because there was uncertainty in how the FBCP would 
react to the FBC impulse from the thrusters. There were concerns that the impulse could cause the FBCPs to collapse 
and/or cause additional dynamic line loading on the FBCPs. The overall system timing was also considered a high 
risk, which included timing from FBCP deployment trigger to thruster unlock and the piston leaving the thruster 
housing. All timing aspects of the separation event needed to be demonstrated by test, to show that the parameters 
captured in the model were bounding and there was no unforeseen timing effects. The last high risk parameter was 
the aeroloads, which were difficult to characterize due to the interactions of moving hardware causing changes to the 
aeroloads. As the jettisoned FBC translates away from the CM, proximity aerodynamic forces and moments change 
as a function of the translation distance from the CM and other variables (captured in a database derived from wind 
tunnel testing at NASA ARC). Other key parameters that drive the design and/or impact multiple hardware elements 
include thruster force profile, thruster reaction loads on the FBC, FBCP peak inflation force including structural 
dynamic amplification factor, thruster side load at thruster fire, free-stream dynamic pressure, FBCP mortar reaction 
loads on FBC, CM total angle of attack, FBC jettisoned mass, FBCP spring constant, FBCP drag area including wake 
pressure recovery fraction (PRF), FBCP temporal line load variability (TLLV) and thruster initiation timing. In order 
to address these key parameters and high risk areas prior to the first unmanned Orion mission (EFT-1), a series of 
integrated tests was added as depicted in Fig. 9. 
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Figure 9. High-level integrated FBC jettison test summary prior to EFT-1. 
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Following an acoustic 
vibration launch and re-entry 
test, a nominal jettison was 
performed on the ground at the 
LM Denver Warterton 
Facility. The purpose of this 
qualification test was to 
expose the jettison hardware 
(primarily structures and 
mechanisms) to the energetic 
environment of FBC jettison. 
Due to the integrated nature of 
the hardware, testing these 
aspects at lower component or 
sub-assembly levels was not 
feasible. The goal of the test 
was to ensure no detrimental 
damage to the FBC, and to 
demonstrate no re-contact of 
the FBC with the CM test 
fixture. The second test 
objective was to provide test 
data for dynamic model 
correlation of simulation 

predictions versus test results. Test data directly supported EFT-1 verification by analysis, and this test was a required 
step in qualifying the mechanism hardware prior to EFT-1. Importantly, this test was sequenced prior to the first 
airdrop FBC jettison, Cluster Development Test (CDT)-3-10, providing risk reduction by demonstrating the FBC 
separation event prior to risking PTV hardware. 

The second ground jettison test in Fig. 9 was considered a developmental test which demonstrated FBC separation 
with a parachute failure. This test was an important EFT-1 precursor for several reasons. One reason was the predicted 
failure of a single FBCP was on the order of one in a thousand, making it a higher failure likelihood when compared 
to the other FBC separation hardware failure modes. The loads for the surrounding CM and FBC hardware from this 
case were a design driver, so validation of the model that produced the design-to loads was important. Additionally, 
near- field simulations of critical clearances between the CM and FBC were showing insufficient clearance in several 
places. These close clearances drove the need to validate this specific model case and therefore the test was added. 

The third ground jettison test was also 
considered a developmental test, simulating 
delayed initiation of a single thruster first 
motion. The relative time between each thruster 
actuation should be no more than 5ms. The test 
delayed a single thruster actuation by 6ms to 
simulate a failure without risking damage to the 
FBC, which had planned re-use for the CDT-3- 
14 airdrop test. The failure scenario is depicted 
in Fig. 10. During vendor testing, there were 
difficulties meeting the timing requirements for 
a single thruster gas generator case, which was 
creating high design-to internal loads. It was 
important to validate and anchor the model for 
the timing delay case and review the resulting 
internal loads. The success criteria were again 
to demonstrate no-recontact and validate the 
simulation. 

All three ground jettison tests were highly 
successful in accomplishing their objectives and all hardware performed well. Inspections were conducted following 
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Figure 10. Thruster gas generator failure scenario. 
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each test and there were no signs of damage to the FBC (which was decelerated by a special catch net) or the Forward 
Bay simulator. The thruster loads were only slightly over-predicted by the pre-test model. 

Following the first ground jettison test, an airdrop test including FBC jettison was performed using the Capsule 
Parachute Assembly System (CPAS) Parachute Test Vehicle (PTV), which was extracted out of a C-17. The test 
justification was that the total system could be uniquely tested, mitigating the risk of relying on multiple non- 
overlapping lower-level tests and models. The primary bridging accomplished by these tests was between the near- 
field jettison simulation and the guidance and navigation simulation, where the focus of these drop tests was to go 
beyond ground testing to understand FBCP load interactions, system timing, and aerodynamics including the blunt 
CM forebody wake. The ground jettison tests isolated the mechanisms and structures and bounded models without 
aerodynamic effects, but the airdrop tests introduced aerodynamic forces, interactive dynamics among the FBC 
separation hardware, and demonstration of the timing between the FBCP mortar fire and drogue mortar fire. These 
were all key areas of risk that were important to test from the key parameters identification process. This first test, 
CDT 3-10, was performed in January 2014 with the primary objective to execute the full EFT-1 mission sequence and 
timing, from FBCP deployment through main parachute steady state, within altitude constraints. Dynamic pressure 
(significantly lower than the nominal EFT-1 entry trajectory) was balanced against vehicle attitude and rates at the 
start of FBC release to ensure that FBC and its separation hardware was not structurally overloaded, and that the PTV 
remained stable. 

CDT-3-10 was a stepping stone pathfmding a way for a more aggressive test (CDT-3-14), the second integrated 
drop test with FBC jettison. Fig. 1 1 shows imagery from CDT-3-14. The key objective was to achieve nominal entry 
dynamic pressure as reasonably as possible while balancing PTV stability and FBC separation hardware structural 
limitations. CDT-3-14 dynamic pressure was roughly doubled from the first test and the FBC jettison altitude was 



FBCP mortar fire after 10 s freefall, followed by jettison 1.4 s after mortar fire 


Figure 11. CDT-3-14 FBC separation event snapshots. 


close to nominal entry. To achieve higher dynamic pressure, CDT-3-14 accomplished an unprecedented 10-second 
uncontrolled free-fall with no parachutes after programmer parachute cut-away (initial PTV total angle of attack was 
dictated by programmer parachutes with four-point attach since Reaction Control System (RCS) is absent for PTV) 
13 . While the PTV is shorter/squatter than the CM, the aerodynamic wakes were reasonably similar. 

Using this new free-fall technique, from programmer release the vehicle velocity increased with a resulting 
dynamic pressure near 100 psf at an altitude of 22,400 ft MSL for FBC Jettison. This was the highest dynamic pressure 
at drogue deploy CPAS has demonstrated on a PTV. One important objective of these two integrated drop tests was 
to collect load measurements on the FBCPs. There are several aspects of the FBCPs modeled by the FBC separation 
near- field simulations, including FBCP off-loading when the FBC is jettisoned, temporal line load variability, and 
transient fly-out angles. These are all important aspects to consider, which ensures that correct structural design loads 
are produced from the near-field simulation. Following the tests, FBCP collapse due to the FBC impulse from the 
thrusters was reduced from high risk to low risk. Each drop test collected a single measurement of the FBCPs (rather 
than three as expected), due to instrumentation anomalies. FBCP static fly-out angles for the two tests ranged up to 
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roughly 10-15° which helped to validate the FBCP riser abrasion contact cone and the method by which structural 
loads are applied to the FBC. Combination of a wide variety of factors contributes to an observed time-varying FBCP 
line load (e.g., wake unsteadiness, FBCP canopy breathing and migration, FBCP cluster effects, riser elasticity), which 
is modeled by the Temporal Line Load Variability (TLLV) model. This model is largely empirical, based on numerous 
sources including Orion 117-CD and 125-CD wind/spin tunnel testing, TAMU wind tunnel testing, USAFA wind 
tunnel testing, Apollo 50-7/8/9/11 and 73-3/4/5 drop testing, and Orion CPAS CDT-3-3/5/7/9/11 drop testing. 
Significantly, integrated drop tests of Orion FBCPs (CDT-3-10/CDT-3-14) revealed that this TLLV model did not 
bound the observed load behavior, which reinforced the need to re-examine the current verification approach. This 
observed behavior also emphasized the need to validate the FBCP performance using full-scale hardware, thus 
improving the modeling which is required to verify requirements. 

The single functioning FBCP load cell on CDT-3-14 exhibited a double peak (Fig. 12) and that behavior was 
unexpected. Since only one FBCP load was captured, a new process was devised to examine thruster and aft 
attachment load mechanism instruments to infer the missing FBCP transient loads, which indicated more than one 
FBCP exhibited similar behavior. These measured transient loads were outside the pre-test TLLV model, so a 
parametric sensitivity analysis was performed to ensure that the EFT-1 design could handle the additional structural 



Figure 12. FBC parachute data only available from an integrated system test. 


loading. Fig. 12 is a representative example of coupled system-level data that can be acquired only from an integrated 
test (and is absent from more affordable stand-alone testing) 14 . These tests provided a rich tapestry of data that could 
only be collected in flight-like testing, including time to line stretch and chute pack deployment within a flight-like 
aerodynamic environment (including free-stream and wake with a forebody similar to the CM), parachute inflation 
(load amplitude and timing), significant temporal line load variability about the mean canopy drag area, and parachute 
off-loading following FBC acceleration under its thrusters. For example, FBC parachute inflation testing requires the 
massively separated blunt body wake flow of the CM forebody. Prior to direct FBCP load measurements, inflation 
properties were inferred from scaled drogue parachute model parameters based on extensive drop testing, but CDT- 
3-10/CDT-3-14 drop testing indicated that FBCP inflation characteristics are biased significantly faster than the scaled 
drogue parachute data predicted, with the K-S statistical test indicating that the underlying distributions are distinct, 
which will be verified by additional FBCP inflation testing. 

The data and models from these airdrop tests were reconstructed and compared to pre-test results for both the near- 
field and mid- field simulations. Generally, the FBC jettison tests demonstrated good correlation to the simulations, 
but there were a few areas that required updates. For example, the model tended to over-predict the jettison suction 
effect. In some cases the thruster loading was over-predicted and under-predicted, but overall good correlation to rigid 
body motion was achieved. Internal loading response predictions were slightly conservative. Twelve additional 
thruster firings from the three ground jettison tests and CDT 3-10 improved the thruster performance statistics, such 
as thruster delay timing, which was updated in the near-field model. Following the near-field simulation model 
correlation, the model was used to conduct the EFT-1 verification of the no re-contact requirement. FBC to CM 
clearances were computed for expected low clearance interaction areas by choosing select physical points. Locations 
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taken from the original physical points were updated with laser-measured points from the EFT-1 
as-built CM. For the nominal and FBCP-failed case, the model showed that all clearances were positive for EFT-1. 

For the mid- field separation performance, an analysis was done for the nominal, FBCP failure and thruster gas 
generator failure. These studies concluded that the FBCP sizing was more than sufficient to avoid interference as the 
FBC attempted to escape from the drogue parachutes deploying from the CM. Even for the contingency case of a 
single FBCP failure, there was roughly 200 feet of minimum separation distance between the FBC and the drogues. 

For far-field separation, Monte Carlo simulations were run using both heritage ballistic coefficient and new 
“adjusted aero” models, including single FBCP failure cases and an updated FBC drag area range based on CFD and 

wind tunnel testing. The analysis used a series of 
seven nested cylinders (Matryoshka Method) as 
shown in Fig. 13. These simulations indicated zero 
re-contacts (cylinder incursions) including zero 
ground strikes, with closest approach being 400- 
500 feet using the ballistic model. For the nominal 
case (ballistic model with three FBCPs 
functioning), the FBC was expected to pass the 
CM in-air for 70% of the cases, with touchdown of 
the second object (CM or FBC) generally 
occurring within roughly one minute of 
touchdown of the first object, increasing to almost 
two minutes with a single FBCP failure. The EFT- 
1 likelihood of a Foss of Test Vehicle (FOTV) 
from far- field recontact was on the order of one in 
ten thousand. 

All of this testing and modeling improved 
confidence for a successful EFT-1 FBC jettison. 
The three FBCPs mortar-deployed and inflated as 
expected, and the thrusters actuated 1.4 seconds 
later, shown in Fig. 14. A clean separation with no- 
recontact was confirmed by on-board and external 
imagery, with acceptable mid-field clearance of 
the drogue parachutes. Far- field splashdown 
locations for CM and FBC were adequately 
separated and near predictions. 


J S 



6im 
223 ft 


Figure 13. Far-field re-contact analysis keep-out 
cylinders (image not to scale). 



Figure 14. FBC jettison seen from Forward Bay of CM. 


The FBC remained intact and in good condition until sinking into the ocean, depicted in Fig. 15. Comprehensive post- 
flight analyses are still in-work, but imagery confirms a successful jettison, and preliminary examination of flight 
instrumentation data (i.e., loads, pressures, distances, photogrammetry, and strains) is in-line with the current 
modeling. 
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Figure 15. FBC after splashdown in the Pacific (EFT-1). 


IV. FBC Separation Event for Human Spaceflight 

The first human mission using Orion, called Exploration Mission-2 (EM-2), is currently planned for December 
2020. Another flight test, Exploration Mission- 1 (EM-1), is planned for September 2018. Orion will qualify to new 
environments between EFT-1 and EM-2, to accommodate pad and ascent abort capabilities. For EFT-1 there was a 
willingness to accept greater risks than allowed by the reliability requirements for a human rated spacecraft. 
Consideration of human safety will increase design and reliability expectations for the FBC separation event, similar 
to the human rating process for the Orion parachute system 15 . 

Following the extremely successful FBC jettison on EFT-1, additional testing and analysis will be required for 
human certification of the FBC separation event starting with the EM-2 crewed flight. This effort will consist of test 
flight and ground test efforts, to provide model and parameter validation data, as well as extensive simulation analyses 
performed to understand flight performance and verify requirements. Building on the strong heritage of the extensive 
EFT-1 test campaign, these additional test efforts are intended to address identified areas of weakness revealed by the 
EFT-1 test campaign (primarily unexpected data losses due to test instrument hardware failures), in addition to 
incorporating the effects of FBC design changes between EFT-1 and EM-2. 

Comprehensive system-level assessment of key FBC separation model parameters was undertaken based on test 
data collected during the EFT-1 test campaign. The planned future test baseline was identified, including a 
qualification ground jettison test as well as EM-1 and Ascent Abort-2 (AA-2) flight tests. The planned AA-2 test 
objectives are currently undergoing review, including consideration of deleting the FBC separation objectives to allow 
for a more affordable test flight. Given the current EM-2 test campaign, additional FBC jettison candidate tests were 
identified, focusing on system-level integrated tests due to the complex coupling among numerous subsystems (e.g., 
retention and release mechanisms, parachutes, parachute mortars, thrusters, structures). Each candidate test was then 
mapped to the key FBC model parameters for which value-added data acquisition would be practical, and subsequently 
ranked based on incremental value within the context of cross-correlation among the test options to optimize the 
candidate test sequences. This risk-weighted method allowed both meaningful assessment of “bang for the buck” 
among test options as well as providing insight into which model parameter validation datasets were weakest (e.g., 
parachute test data being sparser than desired) 16 . 

Primary targets for exploration of additional test opportunities included key models that exhibit high parametric 
sensitivity (e.g., FBC parachute model parameters and multi-body proximity aerodynamics), critical failure scenarios 
(e.g., FBC thruster gas generator, FBC parachute, pad/ascent abort scenarios), FBC drivers of probabilistic risk 
assessment (i.e., mid-field FBC parachutes and far-field FBC trajectory versus CM trajectory), and key system-level 
concerns (e.g., coupled system dynamics and FBC thruster relative timing). Particular attention was given to 
opportunities that leverage tests already planned (piggybacking), as well as hardware refurbishment and re-use to 
achieve test affordability. Risk balance assessments were also undertaken to gain early insight into additional test 
requirements to ensure that schedules for long-lead manufacturing and test sequences (e.g., structural test article 
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testing and parachute qualification drop testing) could accommodate current unknowns associated with potential 
design changes (e.g., FBC thrusters). 

Throughout the process, consideration was given to Apollo flight test experience, particularly with respect to the 
need for full-scale test-like-you-fly integrated system-level testing needed to gain confidence in the design of this 
critical separation event. Additionally, consideration was given to unexpected data acquired during the EFT-1 test 
campaign (especially FBC parachute performance characteristics including inflation 17 and TLLV), accommodation of 
latent failure modes, pursuit of robust testing to uncover “unknown unknowns” impacting performance, expert 
elicitation, leveraging past MPCV test experience and assets, accommodation of residual uncertainties in the final 
design, incorporation of non-test-like-you-fly elements of the test plan (e.g., drop test flight conditions not matching 
entry flight conditions), opportunities for risk reduction to move from empirical to physics-based modeling, resolution 
of test gaps involving risk drivers, achieving adequate levels of test repeatability to reduce risk uncertainties (i.e., 
required number of FBC parachute test demand counts), mitigation of scenarios requiring simulation model 
extrapolation from test-anchored data, and establishing test requirements to achieve acceptable reliability growth 
through execution of the test sequence. Candidate tests (prior to down-select by the entry and landing systems technical 
community) included a diverse array of options. The higher-cost/higher-benefit subset included a Parachute Test 
Vehicle (PTV) airdrop test with a purpose-built FBC integrated into the test sequence as well as ground jettison tests 
and additional data acquisition system hardware for EM-1 and AA-2 18 . Additional candidate tests featuring smaller 
scopes ranged from FBC parachute riser abrasion to the addition of mortared FBC parachutes onto certain PTV drop 
tests (without an FBC) and scaled wind tunnel testing 19 . 

The forward plan is to gain comprehensive stakeholder concurrence on a technical recommendation for additional 
testing, and to mature that recommendation through the MPCV program risk management process to make a program- 
level assessment of the risk bum-down potential versus cost and schedule impacts. The FBC separation event is one 
of the highest-risk events during the vehicle descent and landing phase, such that EM- 1 /AA-2 measures of 
performance for flight test objectives have been designed to ensure that adequate FBC data acquisition will be achieved 
(via flight instmmentation and imagery/video/radar coverage) to meet requirements for model validation including all 
regimes of flight (near-field, mid-field, and far- field). Through this human certification process involving EM-specific 
testing, the MPCV program will execute an affordable test program that yields validation data meeting or exceeding 
requirements to anchor simulation models that verify system requirements and position EM-2 for mission success. 


V. Conclusion 

The highly successful FBC separation event during the EFT-1 flight test in late 2014 was made possible by a 
design methodology that focused on full-scale testability at the integrated system level. By designing a testable 
solution based on identified risks and key model parameters requiring validation, and demonstrating unacceptable test 
coverage gaps in the absence of fully-integrated system-level testing, the multi-disciplinary FBC team realized 
significant risk reduction as well as verification of requirements using adequately data-anchored simulations. This 
flight test success was also made possible by repeated ground jettison testing, addressing key failure modes (including 
the most likely and the most risky), and repeated air drop testing. Complex computational simulation models of near- 
field, mid- field, and far- field regimes were anchored to test data, allowing accurate performance predictions for EFT- 
1. Significantly, there were multiple instrument failures during these tests (e.g., GPS, string potentiometers, 
accelerometers, parachute load cells), however data requirements were ultimately met because of 
(1) planned repeated testing and (2) introduction of new engineering methods to compensate for missing data. 
Additionally, data from these integrated system-level ground and airdrop tests indicated several areas in which test 
data was beyond the bounds of the analytical/empirical models that existed prior to these tests, resulting in EFT-1 pre- 
flight analyses that possessed (1) higher levels of confidence and (2) lower uncertainties. This was especially evident 
with the FBC parachute model parameters. Additional testing going forward, featuring ground and flight tests 
including FBC jettison events, will continue to provide improved validation data for model refinement, positioning 
the FBC separation event for continued success during EM-2. 

For any mission-critical dynamic separation event involving multiple disciplines, leadership needs to be identified 
and held responsible for systems integration. The leadership positions of the FBC Separation Event Lead and the 
NASA Landing Systems Manager contribute significantly to ensuring that critical activities are being identified, 
prioritized and executed. 
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